Why do banks take different approaches to fraud?

When Susan Moon’s accounts were emptied by criminals one bank repaid her but another said she was liable

Scams are often very sophisticated and getting back lost cash can be a harrowing experience (Getty)

The question of who should bear the loss when a banking customer falls victim to a scam is a thorny one. After all, if a customer has been defrauded by a criminal then it seems unfair that they alone should suffer the entire loss. Yet it’s also understandable that few banks want to be responsible for every victim’s money. They can argue that those victims failed to take sufficient steps to protect themselves.

Yet this difficult issue appears to be being answered by banks in different ways and the result is that customers are left confused about whether their bank will have their back if they fall victim to fraud. A lack of clarity on the rules leaves them unsure about whether they can appeal if their bank simply says it will not reimburse them.

It can sometimes feel rather like a lottery, with money being returned or not depending on which bank a customer is with when they are targeted by scammers. That’s a situation perfectly illustrated by pensioner Susan Moon.

When she fell victim to a sophisticated scam two of her accounts were emptied. One bank immediately reimbursed her. The other did not.

Perfect timing

The scammers struck at the perfect time. Susan and her husband had newly moved into their new home and had builders in when the thieves called. They had been travelling until the early hours the night before and had just a few hours’ sleep and Susan was worried about her mother who was unwell.

In the midst of all that came a call from a genuine-sounding man who claimed to be from a BT call centre. Their internet had been compromised, he explained, and he needed to help them protect their accounts. Following his instructions, she and her husband installed software on their computer, entered their bank details and entered information that, without their knowledge, authorised the transfer of money from their accounts.

The scammers were relentlessly plausible, providing a number the couple could call to confirm they were legitimate, offering a code that would be quoted when a “genuine” BT employee called back and reassuring them at every stage that their accounts would soon be safe.

By the time Susan and her husband realised these helpful men were most likely fraudsters it was too late and her money was transferred away into a Metro Bank account.

She explained: “I share an account with my mother so I can help her manage her bills and so on. £3,200 was gone out of that Nationwide account. I just started to sob. Then I went back onto my computer and £3,600 was gone from my HSBC account.

“I just kept crying, we were both so traumatised.”

Distressing dealings

Susan’s experience shows how distressing fraud can be. However, she says her distress was compounded by the different way one of her banks then treated her.

“Every time I spoke to Nationwide it was like they were wrapping me up in a blanket and reassuring me. HSBC were just demanding ‘What did you do?’”

“We had to pick my mum up and she had been ill and I just couldn’t tell her. We felt so stupid! You think you’re savvy but it was just so believable at the time.”

After reporting the fraud on a Friday, Susan had a sleepless weekend. Then on Sunday, she decided to go for a walk to help clear her head.

“On the way back [Nationwide] called. He said, ‘I’m not sure about HSBC but we are going to refund your money.’ I could have kissed his feet because that was Mum’s money. He said it’s fine, he told me to stop blaming myself. He was wonderful and the money was there within two hours.

“The phone went an hour later and it was HSBC. She said, ‘Because you pressed the button on your keypad, you are responsible for that money. We cannot give you the money back.’”

Susan told the HSBC employee that Nationwide had immediately refunded her but says she was told: “All banks do things differently.”

Nationwide told us: “We assess liability on a case-by-case basis but, as a general guide, if a fraudster manages to transact on an account, and the customer did not knowingly authorise and consent to the transaction, we will give a refund.”

An HSBC spokesperson said: “The circumstances of each scam dispute are reviewed on a case-by-case basis. As soon as we were made aware of the payment we contacted Metro Bank to make them aware, but it seems their customer had already withdrawn the money.

“We would encourage people to look at the finance industry’s ‘Take 5’ campaign, which we fully support, which provides information on the techniques used by scammers, as well as giving important advice to customers on what they should do when receiving uninvited approaches and requests to share financial information.”

Fortunately, for Susan at least, there was a happy ending. After calls from this publication, HSBC said it would credit her account with the full £3,600 “as a gesture of goodwill”. Yet she remains shaken by fraud that left her sleepless and tearful, and says that some of that distress was caused by her experiences in dealing with bank employees.

Not clear-cut

It’s easy to sympathise with Susan, who was targeted by thieves carrying out such a sophisticated scam, and to agree that both banks should have immediately paid up to spare her any additional distress. However, it’s also easy to see that if banks have to accept total liability for fraud losses then we will all pay the price.

Nikki Worden is a partner at Osborne Clarke’s financial institutions group, specialising in the regulation of financial services offered to consumers. She says there’s a real danger that making banks liable for losses would drive up the cost of consumer banking, potentially ending fee-free banking or increasing other charges.

“I have sympathy for both sides,” she says. “I think it’s very easy to say ‘this should be done’ but it’s a really complex problem. The more banks pay out then the higher the cost of banking.

“There are also potentially unintended consequences of making banks liable. Just look at the car insurance sector: people made claims for whiplash and it pushed up premiums for everyone.”

Worden also worries that making banks liable would encourage criminals to see bank fraud as a “victimless crime”, when in fact we would all shoulder the burden.

Pépin Aslett, deputy head of the commercial and chancery group at St John’s Buildings, explains that the rules were recently tightened to protect customers from some losses. He says: “From 13 January 2018, the Payment Services Regulations 2017 (implementing the second EU Payment Services Directive) will require banks to refund unauthorised payments no later than the end of the next working day following notification to them. Customers should notify as soon as possible, but do have up to 13 months. The new regulations are a development of existing law.”

Unfortunately for those who fall victim to fraud and authorise payments mistakenly or accidentally, there’s less protection. Aslett adds: “Although there is a presumption that the customer is right, the new regulations dictate that the bank can refuse to refund the money, or can ask for it back, if they can show that the customer authorised the payment by their consent, the customer acted fraudulently, or it is shown they were grossly negligent in protecting their information.”